ouxsoft/luckbydice
The package includes documentation, tests, changelog entries, and release notes, which make the code easier to evaluate. Its long inactivity and workflow weaknesses make adoption a maintenance liability; pin this version only if you can accept that risk.
47%
Total Score
50
100
69
50
Health Score Breakdown
The latest release was in January 2022, with no releases in the last 12 months. The package has a history of nine releases, but the roughly 4 years and 8 months since the latest release materially raises abandonment risk.
The repository had zero commits and zero active maintainers in the last three months, consistent with more than 4 years of apparent inactivity and a serious maintenance concern.
All 29 analyzed action references are unpinned, and one workflow has a high-confidence template-injection finding plus a script-injection count above zero. The cache-poisoning findings are low confidence, so they add only hygiene concern rather than severe risk.
The artifact declares MIT and includes a license file, but the detected license is Apache-2.0, creating an unresolved licensing mismatch despite repository license coverage.
There were no new or closed issues or pull requests in the last month, with one issue still open; this provides no evidence of current maintenance.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 4 years ago
- Created
- 5 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.